Skip to content

Commit 264476f

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-j47g-6v72-x3wr GHSA-3224-p867-265f GHSA-3h75-x2ww-p6ww GHSA-4jxf-pwgr-9m4j GHSA-4v56-g6h4-6655 GHSA-55xf-4pmg-v3xm GHSA-68cf-j259-wgr8 GHSA-6rvw-w3xj-gg67 GHSA-77xw-22r9-95g2 GHSA-8vx8-439w-j8j5 GHSA-9953-hw28-xvx7 GHSA-fv8r-cjf4-v929 GHSA-hmg7-v7c7-65qj GHSA-pg8p-25c5-3f44 GHSA-pgmp-w8v7-hhfx GHSA-q7q5-p52h-85m5 GHSA-r3qv-6v6v-622r GHSA-r58x-2c7j-vfm9 GHSA-r9gx-29q7-44rw GHSA-wmc4-44hv-rxcc
1 parent ef6b308 commit 264476f

20 files changed

Lines changed: 949 additions & 1 deletion

File tree

‎advisories/unreviewed/2025/11/GHSA-j47g-6v72-x3wr/GHSA-j47g-6v72-x3wr.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-j47g-6v72-x3wr",
4-
"modified": "2025-11-12T18:31:26Z",
4+
"modified": "2026-02-25T06:31:14Z",
55
"published": "2025-11-12T18:31:26Z",
66
"aliases": [
77
"CVE-2025-65001"
@@ -26,6 +26,10 @@
2626
{
2727
"type": "WEB",
2828
"url": "https://security.ts.fujitsu.com/ProductSecurity/content/FsasTech-PSIRT-FTI-FCCL-2025-072319-Security-Notice.pdf"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://ydinkin.substack.com/p/200-kernel-bugs-in-30-days"
2933
}
3034
],
3135
"database_specific": {

‎advisories/unreviewed/2026/02/GHSA-3224-p867-265f/GHSA-3224-p867-265f.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3224-p867-265f",
4+
"modified": "2026-02-25T06:31:15Z",
5+
"published": "2026-02-25T06:31:15Z",
6+
"aliases": [
7+
"CVE-2026-3100"
8+
],
9+
"details": "Improper Certificate Validation vulnerability in ASUSTOR ADM FTP Backup on Linux, x86, ARM, 64 bit allows Sniffing Attacks.This issue affects ADM: from 4.1.0 through 4.3.3.ROF1, from 5.0.0 through 5.1.2.RE51.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3100"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.asustor.com/security/security_advisory_detail?id=53"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-295"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-02-25T06:16:26Z"
35+
}
36+
}

‎advisories/unreviewed/2026/02/GHSA-3h75-x2ww-p6ww/GHSA-3h75-x2ww-p6ww.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3h75-x2ww-p6ww",
4+
"modified": "2026-02-25T06:31:15Z",
5+
"published": "2026-02-25T06:31:15Z",
6+
"aliases": [
7+
"CVE-2026-25785"
8+
],
9+
"details": "Path traversal vulnerability exists in Lanscope Endpoint Manager (On-Premises) Sub-Manager Server Ver.9.4.7.3 and earlier, which may allow an attacker to tamper with arbitrary files and execute arbitrary code on the affected system.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25785"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://jvn.jp/en/jp/JVN79096585"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.motex.co.jp/news/notice/2026/release260225"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-22"
38+
],
39+
"severity": "CRITICAL",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-02-25T06:16:25Z"
43+
}
44+
}

‎advisories/unreviewed/2026/02/GHSA-4jxf-pwgr-9m4j/GHSA-4jxf-pwgr-9m4j.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4jxf-pwgr-9m4j",
4+
"modified": "2026-02-25T06:31:15Z",
5+
"published": "2026-02-25T06:31:15Z",
6+
"aliases": [
7+
"CVE-2026-3163"
8+
],
9+
"details": "A vulnerability has been found in SourceCodester Website Link Extractor 1.0. This vulnerability affects the function file_get_contents of the component URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3163"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://medium.com/@hemantrajbhati5555/ssrf-vulnerability-in-sourcecodester-website-link-extractor-v1-0-5df6bb708f5e"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.347670"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.347670"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.758932"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sourcecodester.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-918"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-25T06:16:26Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-4v56-g6h4-6655/GHSA-4v56-g6h4-6655.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4v56-g6h4-6655",
4+
"modified": "2026-02-25T06:31:15Z",
5+
"published": "2026-02-25T06:31:15Z",
6+
"aliases": [
7+
"CVE-2026-3150"
8+
],
9+
"details": "A security vulnerability has been detected in itsourcecode College Management System 1.0. This affects an unknown part of the file /admin/display-teacher.php. The manipulation of the argument teacher_id leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3150"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Zhangchao404/cve/issues/2"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://itsourcecode.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.347658"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.347658"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.758829"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-25T05:17:29Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-55xf-4pmg-v3xm/GHSA-55xf-4pmg-v3xm.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-55xf-4pmg-v3xm",
4+
"modified": "2026-02-25T06:31:15Z",
5+
"published": "2026-02-25T06:31:15Z",
6+
"aliases": [
7+
"CVE-2026-3147"
8+
],
9+
"details": "A vulnerability was found in libvips up to 8.18.0. This affects the function vips_foreign_load_csv_build of the file libvips/foreign/csvload.c. The manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been made public and could be used. The patch is identified as b3ab458a25e0e261cbd1788474bbc763f7435780. It is advisable to implement a patch to correct this issue.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3147"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/libvips/libvips/issues/4874"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/libvips/libvips/issues/4874#issue-3943617697"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/libvips/libvips/pull/4894"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/libvips/libvips/commit/b3ab458a25e0e261cbd1788474bbc763f7435780"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/libvips/libvips"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?ctiid.347653"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/?id.347653"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://vuldb.com/?submit.758692"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-119"
62+
],
63+
"severity": "MODERATE",
64+
"github_reviewed": false,
65+
"github_reviewed_at": null,
66+
"nvd_published_at": "2026-02-25T04:16:05Z"
67+
}
68+
}

‎advisories/unreviewed/2026/02/GHSA-68cf-j259-wgr8/GHSA-68cf-j259-wgr8.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-68cf-j259-wgr8",
4+
"modified": "2026-02-25T06:31:15Z",
5+
"published": "2026-02-25T06:31:14Z",
6+
"aliases": [
7+
"CVE-2026-27744"
8+
],
9+
"details": "The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pages. The plugin appends untrusted request parameters into HTML that is later rendered by a template using unfiltered environment rendering (#ENV**), which disables SPIP output filtering. As a result, an unauthenticated attacker can inject crafted content that is evaluated through SPIP's template processing chain, leading to execution of code in the context of the web server.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27744"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://git.spip.net/spip-contrib-extensions/tickets/-/commit/869935b6687822ed79ad5477626a664d8ea6dcf7"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.spip.net/tickets"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/spip-tickets-unauthenticated-rce"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-94"
38+
],
39+
"severity": "CRITICAL",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-02-25T04:16:04Z"
43+
}
44+
}

‎advisories/unreviewed/2026/02/GHSA-6rvw-w3xj-gg67/GHSA-6rvw-w3xj-gg67.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6rvw-w3xj-gg67",
4+
"modified": "2026-02-25T06:31:15Z",
5+
"published": "2026-02-25T06:31:15Z",
6+
"aliases": [
7+
"CVE-2026-27745"
8+
],
9+
"details": "The SPIP interface_traduction_objets plugin versions prior to 4.3.3 contain an authenticated remote code execution vulnerability in the translation interface workflow. The plugin incorporates untrusted request data into a hidden form field that is rendered without SPIP output filtering. Because fields prefixed with an underscore bypass protection mechanisms and the hidden content is rendered with filtering disabled, an authenticated attacker with editor-level privileges can inject crafted content that is evaluated through SPIP's template processing chain, resulting in execution of code in the context of the web server.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27745"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://git.spip.net/spip-contrib-extensions/interface_traduction_objets/-/commit/db3417b7811774f04c3ff191ca1737fe660ef0be"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.spip.net/interface_traduction_objets"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/spip-interface-traduction-objets-authenticated-rce"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-94"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-02-25T04:16:05Z"
43+
}
44+
}

0 commit comments

Comments
 (0)